c5e09a1592baf021b61fb2142507aef833eee8efb1c25055406186db7b9d3ec8 | Triage

Sharing

General

Target

05455aa034f50619efe924e56d008725_JaffaCakes118
Size

150KB
Sample

241001-lja4qasdlp
MD5

05455aa034f50619efe924e56d008725
SHA1

eb96a81e678600c4cf44c4b896a975759db5da39
SHA256

c5e09a1592baf021b61fb2142507aef833eee8efb1c25055406186db7b9d3ec8
SHA512

d8a95588b3e802c02df83fc9e6513991905f85d2d5da5c926fe202af25556c87b1444828d866cd85ad1e94456ed50c8921b0cabe124b3f77ff569b27fded026c
SSDEEP

3072:t+HCQvA+xM5soj5SCB+oLtLjFZUQ1r2UgPD7SMm2EwyP:tIvA+xM5FB3Fh2Ug77Lm2E

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  05455aa034f50619efe924e56d008725_JaffaCakes118
- Size
  
  150KB
- MD5
  
  05455aa034f50619efe924e56d008725
- SHA1
  
  eb96a81e678600c4cf44c4b896a975759db5da39
- SHA256
  
  c5e09a1592baf021b61fb2142507aef833eee8efb1c25055406186db7b9d3ec8
- SHA512
  
  d8a95588b3e802c02df83fc9e6513991905f85d2d5da5c926fe202af25556c87b1444828d866cd85ad1e94456ed50c8921b0cabe124b3f77ff569b27fded026c
- SSDEEP
  
  3072:t+HCQvA+xM5soj5SCB+oLtLjFZUQ1r2UgPD7SMm2EwyP:tIvA+xM5FB3Fh2Ug77Lm2E
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence